HackTricks-wiki/hacktricks: Running the Pentest Wiki Locally with Docker and mdBook

What HackTricks is, and who actually needs it

HackTricks is a wiki. The project describes itself as the place where the author collected "each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news", and the repository is organised around that: a src/ tree of Markdown chapters, a theme/ directory, and a book.toml that tells mdBook how to render it. The homepage points at book.hacktricks.xyz, so the primary artefact is a published book, not a library you import.

The audience is narrow but real. Someone working through a CTF box, a pentester who needs the exact syntax for an SMB relay or an AWS role assumption, or a learner who wants a reference that stays on the machine when the network does not. The topics list (hacking, hacktricks, peass, pentesting) matches that. If you want a tool that takes a target and returns findings, this is not that, and no part of the repository pretends otherwise.

How the book is built: mdBook, a preprocessor and per-language branches

The architecture is a static site generator with a custom step in the middle. book.toml configures mdBook. The repository root also contains hacktricks-preprocessor.py, which the mdBook preprocessor hook invokes; the environment variable MDBOOK_PREPROCESSOR__HACKTRICKS__ENV is set to dev in both the Dockerfile and docker-compose.yml, which is how the preprocessor knows it is running a local build rather than the published pipeline. scripts/ and clean_unused_images.sh sit alongside it for asset handling.

Language switching is not a runtime setting. Each language is a git branch: master for English, plus af, de, el, es, fr, hi, it, ja, ko, pl, pt, sr, sw, tr, uk and zh. The container checks out the branch named by HT_LANG and pulls it. That is a simple design with a visible cost: you cannot read two languages at once from one working copy, and switching means re-checking out and letting mdBook rebuild.

The release list reinforces that the book is the product. The most recent releases are searchindex-en, searchindex-zh and searchindex-uk, dated 2025-10-01. Search indexes ship as release artefacts, which is what makes the published site's search work across a large corpus. The last push to the repository was on 2026-09-21.

Installing HackTricks locally with Docker

The README gives two paths. The first is an explicit docker run that clones the repository, selects a branch and starts mdBook. The second is docker compose up from the repo root, which uses the bundled docker-compose.yml and serves whatever branch is currently checked out on the host, with live reload.

Start by cloning, then pick your language branch with HT_LANG. Leaving it as master gives English:

git clone https://github.com/HackTricks-wiki/hacktricks
cd hacktricks
export HT_LANG="master"

The README notes the other branch codes, including es for Spanish, fr for French, ja for Japanese, uk for Ukrainian and zh for Chinese. If you prefer Compose, the whole service is one command from the repository root:

docker compose up

The compose file pins platform: linux/amd64 with the comment that the published image is amd64-only, maps host port 3337 to container port 3000, mounts the repository as /app, and runs mdbook serve --hostname 0.0.0.0 --port 3000. On Apple Silicon or an arm64 host you are running under emulation, which is why the platform line is there.

The README states the book is available at http://localhost:3337 and that it can take under five minutes to appear because mdBook has to build it. If nothing shows up, the repository root keeps .mdbook-build.err and .mdbook-build.log, which is where a failed build leaves its output.

The docker run form, and what the container does on startup

The README's explicit command is worth reading closely because it does more than start a server. It seeds known_hosts for github.com, marks /app as a safe git directory, checks out the language branch, pulls, and then serves. The same sequence appears in the Dockerfile, where HT_LANG is an ARG defaulting to master and the final CMD sets MDBOOK_PREPROCESSOR__HACKTRICKS__ENV=dev before calling mdbook serve on port 3000.

docker run -d --rm --platform linux/amd64 -p 3337:3000 --name hacktricks \
  -v $(pwd)/hacktricks:/app \
  ghcr.io/hacktricks-wiki/hacktricks-cloud/translator-image \
  bash -c "mkdir -p ~/.ssh && ssh-keyscan -H github.com >> ~/.ssh/known_hosts && cd /app && git config --global --add safe.directory /app && git checkout $HT_LANG && git pull && MDBOOK_PREPROCESSOR__HACKTRICKS__ENV=dev mdbook serve --hostname 0.0.0.0"

The consequence is that the container reaches out to GitHub on every start and performs a git pull. That keeps content current, and it also means a start can fail for reasons that have nothing to do with your machine: network policy, GitHub availability, or a branch that no longer exists. The image name, translator-image, is a hint that it was built for the translation workflow, and the compose file notes it is amd64-only.

Where a static book is the wrong tool

HackTricks has no execution layer. Nothing in the repository layout suggests a scanner, a target list, or a result store. It is Markdown compiled by mdBook into HTML. If you need to run a check against a host and get a pass or fail, you are looking at the wrong project.

The content is also a moving target. The README's own flow does a git pull on startup, and the Dockerfile does the same, so the page you read yesterday may differ from the page you read today. For a reference that is a feature. For anything you want to cite in a report, pin a commit or a branch state rather than relying on the served copy.

Language coverage is uneven by construction. The branch list includes sixteen codes, but each is maintained separately, and the project's own documentation does not indicate that a translation tracks the English source at any particular lag. If you read in a non-English branch, treat it as a separate document with its own freshness, not as a mirror.

Finally, the repository records no licence. The README does not state one either. If you plan to redistribute the content, mirror it, or reuse chapters inside training material, that is a question the project's own files do not answer, and it is not one to resolve by assumption.

HackTricks versus a general-purpose online reference

The obvious alternative is reading the published site at book.hacktricks.xyz and never touching the repository. The difference is not quality, it is where the content lives and what you can do with it. The hosted book gives you the search index the release artefacts are built for, without a container, without a git pull on every start, and without a build that can take minutes. That is the right choice for a quick lookup on a machine with a working connection.

The local build buys three things the hosted site does not. It works when the network does not, which matters on an engagement or in a lab that is deliberately isolated. It lets you check out a specific branch or commit and read a fixed version. And it lets you edit the Markdown and see the result through mdBook's live reload, which is the reason the preprocessor and the theme directory are in the repository at all. If none of those three matter to you, the container is overhead: several minutes of build time and an amd64 emulation penalty on arm64 hardware, in exchange for a copy of something you could have loaded in a browser tab.

Maintenance, upgrade cost and the licence question

The last push to the repository was on 2026-09-21, and the repository is not archived. The search index releases are dated 2025-10-01, so the index artefacts and the content are produced on different schedules.

Upgrading is mostly free, and that is the design. Because the container pulls on start, a fresh docker compose up picks up whatever is on the branch. There is no version to bump and no migration step. The cost you do carry is the build itself: mdBook has to render the book each time, which the README describes as taking under five minutes, and the compose file's platform: linux/amd64 means arm64 users pay an emulation tax on top. If you want a stable target, the branch is your version pin, not a release tag.

On licensing, the honest position is that the repository records the licence as unknown and the README does not state one. That is not a detail to wave away. Redistribution and commercial reuse depend on terms that are not visible in the repository's own description, and the correct next step is to look at the repository's licence file and any per-chapter notices before you mirror or republish anything. Nothing here should be read as legal advice.

Editorial conclusion

Adopt HackTricks if you want a searchable, offline-capable pentest reference with per-language branches and you are willing to run a container that mounts the whole repo. Do not adopt it as an automated scanner, a reporting tool, or a substitute for a course: it is a book, and the README's own install path builds that book. Before relying on it, confirm which branch you checked out (HT_LANG), confirm the image still resolves on ghcr.io, and read the licence situation yourself, because the repository's own metadata records no licence.

Frequently asked questions

Official sources

1. HackTricks-wiki/hacktricks on GitHub
2. Issues
3. Project website
4. README
5. Releases